Security
What the findings of the security check mean and how to fix them. The topics follow the categories of the report.
HTTPS and transport
What HTTPS does
HTTPS encrypts the connection between browser and website. Nobody on the way can read or change what is sent, and the browser knows it really is talking to your site.
What HSTS does
HSTS tells the browser that your website can only be reached over HTTPS. From then on it never calls it unencrypted again, even when someone types “http://”.
How to set up TLS securely
Which protocols and cipher suites your server offers decides how well an HTTPS connection really protects. A current setup is short and works with every browser in use today.
What makes a good certificate
A TLS certificate has to be more than valid: renewed in time, with a key long enough and a complete chain, with proofs from Certificate Transparency and backed by a CAA record.
Injection protection
What a Content Security Policy does
A Content Security Policy states from which sources your page may load scripts and other content. It is the most effective protection against injected scripts.
What X-Content-Type-Options does
The X-Content-Type-Options header with the value “nosniff” stops the browser from guessing the type of a file. A harmless text file cannot turn into a script that runs.
What clickjacking protection does
Clickjacking protection forbids other websites to embed your page in a frame. Nobody can then trick visitors into clicks they cannot see.
Isolation and privacy
What the Referrer-Policy does
The Referrer-Policy states how much of your page's address other websites learn when a visitor follows a link or content is loaded. It keeps search terms, identifiers and tokens in addresses from leaking out.
What the Permissions-Policy does
The Permissions-Policy states which browser features such as camera, microphone or location your page and embedded content may use. It lets you switch off whatever your site does not need.
What the cross-origin headers do
The cross-origin headers separate your page from other sites' windows and pages. They protect against attacks that pull data out through open window links or memory shared in the browser.
What CORS does
CORS controls which other websites may read your server's answers in the browser. Set up wrongly, it lets any website fetch data in your visitors' name.
Cookies and disclosure
What makes cookies secure
Secure cookies carry the attributes Secure, HttpOnly and SameSite. They then travel only over encrypted connections, stay hidden from scripts and are not sent along by other sites.
What your server gives away about itself
Many web servers and applications name their software and version number in their response headers. That helps nobody but attackers, who use it to look for known vulnerabilities.
What legacy security headers are
Legacy security headers date from a time when browsers still read them. Today they do nothing or even do harm, and they should be removed.
What security.txt does
security.txt is a small text file at a fixed address on your website. It tells anyone who finds a vulnerability where to report it.